Sure but you can hardly place the same onus of security rigor on the shoulders of a 90's OS/2 software hobbyist enabling people to explicitly download font file

Sure but you can hardly place the same onus of security rigor on the shoulders of a 90's OS/2 software hobbyist enabling people to explicitly download font files once in a blue moon from sources they explicitly choose, vs a big corporation in the 00's employing world class product security staff deciding to stick that in their source tree without even a shrug, where the downloading and applying the fonts happens behind the users back with 0 interaction.